diff options
| -rw-r--r-- | gst/mpegdemux/mpegtspacketizer.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/gst/mpegdemux/mpegtspacketizer.c b/gst/mpegdemux/mpegtspacketizer.c index a9a69c9d3..118a3acc5 100644 --- a/gst/mpegdemux/mpegtspacketizer.c +++ b/gst/mpegdemux/mpegtspacketizer.c @@ -2197,6 +2197,12 @@ mpegts_packetizer_push_section (MpegTSPacketizer * packetizer, if (packet->pid == 0x14) { table_id = data[0]; section->section_length = GST_READ_UINT24_BE (data) & 0x000FFF; + if (data - GST_BUFFER_DATA (packet->buffer) + section->section_length + 3 > + GST_BUFFER_SIZE (packet->buffer)) { + GST_WARNING ("PID %dd PSI section length extends past the end " + "of the buffer", packet->pid); + goto out; + } section->buffer = gst_buffer_create_sub (packet->buffer, data - GST_BUFFER_DATA (packet->buffer), section->section_length + 3); section->table_id = table_id; |